Vietnam — Law on Artificial Intelligence (2025): AI Compliance Requirements

Classify each AI system you deploy in Vietnam as High, Medium, or Low risk based on its potential impact on human life, health, lawful rights and interests, public interests, and social order. HIGH-RISK systems — those that could significantly harm life, health, fundamental rights, or national security, as designated by the Prime Minister — require pre-deployment conformity assessment, registration, third-party audit / periodic inspection, technical dossiers and activity logs, and human-in-the-loop oversight. MEDIUM-RISK systems (e.g. chatbots or deepfakes that could confuse or manipulate users) require monitoring and transparency. LOW-RISK systems follow voluntary best-practice guidance. The specific high-risk list is set by the Prime Minister / Government, with criteria from the Ministry of Science and Technology.

AI systems generating audio, image, or video content must mark outputs in a machine-readable format per Vietnamese Government regulations. Deployers must clearly indicate when AI-generated content could be confused with authentic events or real people. This applies to any AI content generation service accessible by Vietnamese users.

Providers of generative AI systems must disclose the sources of the data used to train their models — a transparency duty that is separate from, and in addition to, the machine-readable watermarking/labelling of AI-generated content. This applies to generative-AI services made available to Vietnamese users.

Document how your organization develops, deploys, or uses AI systems under the Vietnam AI Law framework. Address the three-tier risk classification, human rights safeguards, and prohibited practices (bias, discrimination, misinformation, false advertising). Health, education, and finance sector operators have an extended compliance deadline until September 1, 2027.

Decree 142/2026/ND-CP (the AI Law's first implementing decree, eff. 1 May 2026) requires providers and deployers to submit a preliminary report of a serious AI incident through the Ministry of Science and Technology's "One-Stop Electronic Portal on AI" — within 72 HOURS for urgent/uncontrolled incidents, or within 5 WORKING DAYS for other serious incidents. The same portal receives risk-classification results and conformity-assessment outcomes, and issues each in-scope AI system an identification code (pre-deployment notification is required for medium- and high-risk systems). This is a distinct, previously-untracked duty layered on top of the three-tier risk-classification requirement above.